Reddit OSINT Techniques 


‘Rodel is socal media platform that does not get as much attanion inthe open source 
‘nteligance (OSINT) world as the big payers such as Twitar and Facebok. However the open 
nature of mast boards, also known as subredlts, make ita must check when doing an OSINT 
‘investigation on a targt. Redd i algo ane of he few social media platforms that have a robust 
sel of hité-party tols which make investigation even easier, going so far as allowing 
Investigations to obtain content which may have been previously deleted. 


“This articles designed to guide you through all ofthe various points of expleitations that a 
Reddit account may have avaiable. wil provide references to what information can be 
‘oblainad, as well as provide some of my specialty-craftd tools and echniques for making your 
FRodait investigation more streamlined and efficient. 


Username 


= 


woskandenae 
Karma Cake day 
Bess & soni. 2087 


Every Redkit account wil have @ usemame by defauit and wil appear above the user's posts as 
‘well as on ther profile page. Investigators should take note of any identifiable information within 
the usemame, such as names, signifcant numbers (possible bith date or year, area code, etc) 
Corhints ofa location. Many online users are paral tether usemames, ad wil use the same 
‘username across multiple platforms. For this reason itis good practice to look fr the Ral 
‘username across other social media platforms, in search engines, or on message boards. When 
‘doing £0 be cognizant of fale posivas which may accur due ta a common username, 


In the example above, the username provides a fw bis of information that might assist in 
“dontitying them. Oakind likely refers toa city, which they might reside in or orginally be from, 
while Chi could be a nickname ora refrerce lo a second cy such as Chicago, Finally the 84 at 
the end ofthe username could signy a highlymportant date tothe user, possibly ther bith 
year, the year af an academic graduation, ee, 


Avatar 


Albaugh technically all Red accounts should have an avatar / profile photo image by default 
they ae ofen lft as those automatically generated by the site rather than one chosen by the 
‘account owner. This is because Redelt generates an avatar depicting their mascot by default for 


‘This can be seen inthe fist example above. Ifyou are unsure whether itis a default avatar or 
‘not, you can cross reference against the known default avatars hare. Also be aware that edt 
‘might replace the user's avatar with an image stating thatthe user has mature (18+) content. An 
‘example ofthis can be seen above in the second avatar. Inaction to these patform-ganerated 
profiles, a usar may also upload ther own avatar such as the thie example above, 


“Theft thing do with every photo I run across curing an investigation is run it through a 
reverse image search such as images. qooals.com (or Tineye, Bing, ec). This is done to find 
_any aditonal websites that might include the same photo. A reverse image search may assist 
In uncovering addtional user accounts if the target reuses the same profile photo across 
platforms. large numberof matching images might also help an investigator determine if the 
‘holo was just ripped trom elsewhere onine 


Following a reverse image search| then attempl to obtain the largest resolution image so that | 
an further analyze the Contents. A high resolution image is much easier to analyze than the 
dofault size shown on ther Reddit profi. In order to aban the larger image | created a 
Javascript bookmark o pull the fl size profile photo via the source code ofthe target's Rede 
profile. 


“There are afew points of inforest within this photo wort pointing aul For one, the male inthe 
center ofthe frame could perhaps be the account owner. There is also unique architecture, such 
_as what appears to be a church inthe background, the fence, and the unique styled shops and 
‘bulings to the right ofthe male fgure. There is also what appears to be a unique sicker onthe 
buling in the front. Unique graft and sticker slaps that showease local aris, vanues, oF 
‘bands can often assist in narowing down a photo's locaton as wel. Reverse image searches 
for this avatar came back with posiiva results n which the owner of the Redlit account uiized 


the same usemame and profile photo on ational websites. This would give me addtional 
Sites to look at and would assist in narrowing down the identity of my target 


Pages that include matching images 
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‘A.sor’s topics ara the threads or posts in which they are the orginal poster (fen referred to as 
the OP’), rather than usta commentator, and may include tex or images. n order to view al of 
‘users tops you can navigate other profile page and click on posts atthe top ex 


nips laure. comiuseriREPLACEWITHUSERNAME/posts!) Once there you can scroll 
through their ist of tapies and cick anthem individually to s2@ more information. Also pay 
attention tothe diferent subrecklis in which they frequent inorder to gel a good read on their 
Interests. Be sure to read all oftheir opis carefully for any clue, whathar in thei text a in any 
attached images or links. 


Inthe example above we can see @ commonality amang tis section ofthe use's posts. Many 
‘of his opis are posted within European subraddlis and the user also appears to have an 
Interest in history, You may alsa notice the user's ac (which wil be further explained balow) in 
‘mutple subredilits aso indicaes the usar may be Polsh andr living in Poland 


Posts: Comments 


4 ms 
Close yes! believe I took this around Kutztown PA, 


(W Foply Give Award share Repart Save 


‘Comments are user's response to thei or another user's topic ar comment. Thay may inlude 
{xt or tinks to another website or image. To view all fa user's topics you can navigate to their 
profile page and cick on comments at the top. (eX: 

‘np: rectdt.comluserREPLACEWITHUSERNAME/comments!) Once thera you can 
‘rol through lf ther comments and click on tham individually to see more information. As 
with tpies be sure to look for any identifiable information in the text and inks that might help 
“deny your target. 


Inthe exampa above, we can see thal the user has at ne point ban tothe ety mentioned 
where they took a photo thal was inthe original post. This could assist in narrowing down theit 
‘general location. Its also worth noting that tha microphone tothe right ofthe usemame 
Indicates that the commentator is also the parsn which orginally posted te topic. 


Posts: Deleted Content 
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Ladies and gentlemen, this is where Reddit outshines nearly every social meta platform in 
terms of OSINT-fiendiness, Quite often once a social mada post gone i shard to retrieve i 
for analysis unloss someone captured via.a scrgenshot or on one ofthe many archiving sites 
‘such as tha WayBackMachine. This snot the case with Radi. Instead, ther is a handy 
\wobsita called Removedst (among thers) that allows investigators to view comments and 
{opics removed automatically by a moderating bet, or manually by the user ora moderator of 
the subreddit. Although it does go down fom time to time, | have successfully used ita find 
“donate information on targets who made posts and then removed them falar on while tying 
to hide their identity or ater rying to improve their OPSEC. 


Looking atthe above post. can sae that there ware a least twa posts inthis thread that had 
‘been removed. |opened up the Removed version af the Redlt thread by using 2 
‘bookmarklet to automatically replace “red with removed” in my ur bar. Doing so allowed 
‘me fo se most ofthe removed comments below. 


Abaugh thase posts do not assist in further identifying the users), they do offer a grat 
‘example ofthe different types of responses you can get using Removeddt. Sometimes the user 
\olote thir post quicly aor they made it in this case it wil not be captured in time. The 


Lifrent colors indicate whether the posts were remaved from a mod or via the user. Another 
thing o note is thatthe username may not be visible an the orignal Reddit thread, but 
‘ttentimas remains onthe Remavecdt version, 


Posts: Flair 
kar et ee ee 
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I set, a user's tar will appear to the right oftheir username on their posts and topics. Flair can 
provide adional information on a Redkst user, such as location or afliation, and may exist a 
tex ora a small emoj A user's air difers depending on how itis sel up within each subredlt 
‘they post within, with some not having any Nas) set at all. Be sure to look through all ofa 
‘User's posts and topics to gat an idea ofthe diferent (ypas affairs they usa across ciferent 
subrecklis, 


“The examples above include a taxt fai anda text and emi combination fat. The fst fale 
denotes the user's location as Denmark and in-game team affiation and level as Valor and 
level 40 respectively. The second example could suggest thatthe users erginaly from 
(Greenland and yet may curently reside in Denmark 


Profile: Banner 


“BOGART &¢ 


Bogart Creek 
wfbogarerek 
‘Bogart Creekis a single panel comic of 
dark and absurd hurmour created by 

Alertan cartoonist Derek Evernden. 

cake day 
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MORE OPTIONS 


‘Like many other social media platforms, Red alows users to add an additonal image to thir 
profi in the form of a banner. This short and wide image wil be displayed al the top ofthe 
profile bahind the profile photo. Unika a Red avatar/ profia photo, the banner wil be blank 
Lunt the user decides to upload one. In order to obtain the fullsize image of the banner, | 
‘ealad a javascript bookmarklet o pull the ful size banner image from a targets profile. 


<BOGART &? 


bebe 


Naw that wa have the fl size phato we can mare easily read the signature af what we can 
‘assume is the artist nthe lower-right side of the image. Just ke with any phatos you run 
‘across, you wil want fo run a reverse image search and inspect the highest resoluton of the 
‘banner as possible fo gather any adelional information. Itis woth ating that Google reverse 
Image searches are quite apt al detecting images that were edited so long as enough of the 
‘orginal phot is sil ntact. Asan example, running a revrsa image search onthe banner 
above brought back a modified version ofthe same photo which was being used by the target's 
Facebook page and the website dedicate tothe comic. 


Pages that include matching images 


Bogart Creek - Home | Facebook 
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Profile: Display Name 
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Big Bad Jim HotRod im 
came yeamace 
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ame oe 


‘Rodel users may choose to add an adltonal display name to ther proile, Alhough users may 
‘not change ther edt name, they can change their display name multiple times should they 
‘sh to. This name will appear onthe user's profile between teir avatar and their usemame, 


‘This wil otherwise be blank by default. Be sure to capture any changes in a target's display 
‘name as they may offer addtional clues, such as their name or additonal usernames to search 


Inthe above example, we see wo diferent iterations ofthe user's display nama, bath of which 
Include the name Jim. This might be an indication ofthe user's actual frst name, 


Profile: About 


Bogart Creek 
oogreresk 

Bogart Creek sa single panel comic of 
dark and absurd humour created by 
plbertan cartoonist Derek Evernden, 
Karma cake day 
sens fe Fotrry 39,2008 


|A Red user's profile may also contain a small section of text thatthe user ads fr their About 
section. The About section will appear o na use's profile between ther name(s) and thei karma 
and cake day information. Ths section is blank by default, however it can often provide a good 
bitof information onthe subject, especially if they are the type to openly share information or 
_are tying fo gel their nama or brand seen by more people. Thal being sad, be mindtul of any 
attempts ofa user using this section to mislead or profile false information, 


‘Our above example shaws thal the account is owned by the ats of the comic ti which 


shares the same name asthe Redkituser. In this example the user also provided their name as 
‘Wal as thee locaton, 


Profile: Karma 


Shitamerianesay 
arma cake day 
eos tay 29202 


“Think of Karma as (kinda) intangible intmet points. When a user posts atopic or comment 
other users can upvote or downvote their submission, which in tum aflacts their overall karma 


‘amount displayed on their profile, Some users take great lengths to ge hel karma counts as 
high as possible, and some subraddlis may be dificult to post in with negative karma as a way 
(of weeding out spam and tll accounts. 


Inthe example above, there is an olde account which has nagative Karma, Daspita being older, 
thera are no recent post by i and allo its comments appear to be from around the time the 
account was created. Based on ths, it would be safe to say that was a roll account atthe tine 
‘twas active, which can be further confimed based on the users bret post history 


Profile: Cake Day 


me catty + meiivie + - 
cat oe + Gipected 


\w Reply Ge Award. share Report Save 


|A Red user's "Cake Day’, the day in which they created thee Reddit account, wl dsplay on 
the right side of their user profi. Itcan help assist in determining the age ofthe account and 
‘can be usa in cajunetion with a user's overall Karma count (discussed in more detail below) to 
termine i an account isa voll or shiposter (ow karma, recent Cake Day) rather than 2 
raguar user. On their Cake Day anniversary, the user wil have asic of cake othe right of 
thelr username on ther topics and comments 


Inthe example above we can ste that our user had a cake day during the ima of me wring this 
portion af the atic, We are able to kee thatthe account is ana yeaa and has a good bit of 
‘karma, suggesting that tis a legimate user and tkely not atoll account. 


Profile: Trophy Case 


‘woPwr case (0 


6 Eight-Year Club 
@ Reddit Premium 
G Not Forgotten 
@ Verified Email 


Rd user's can also accumulate trophies, which wil be eisplayed on the user pofie's Trophy 
‘case. Thase trophies can be ablained from a number of fferent thing, such as caninbutions to 
the ste or ubmiting popular content. In an investigation, trophies that | fend ta ba most 
Interested in ae those related tothe account age and tha verified email. You can alsa finda st 
fall current Red trophies hers 


‘Our above example has afew trophies which help us datermine tha the accounts legitimate 
and tkely nota tall or towaway account. For ane, the account has the rophy which is given to 
Redd accounts that have been around freight years. Secand, the user has paid money to 
Rudin order fo obtain a premium account. Finally, the user has a verted aml attached to 
the account. tis worth noting here that at the time of his article being writen an email account 
‘was stil not aquired to make a edit account 


Profile: Connected Account(s) 


ebronpesaaverk 


¥anabled, connected accounts wil appear onthe right hand side of a user's profile. Connacted 
‘accounts ara other social macia accounts that are tied tothe Rack account via the auner of 


‘both accounts. This wil show you addtional accounts that the Reddit user has on another 
slatfarm. This makes finding adtional accounts to explo far easir than having to search for 
thom, Al this ime | have only sen this fo Twiter accounts. 


‘Above we see a Twitter account thal was connected by the Red user. Its wort noting that 
the Twitter and Rede accounts did nt use the same username, which may have hindered us 
finding the Twitter account had the user not directly connect it It also provides us with an 
_aaltonal username to search for an ther social mec platforms. 


Profile: Moderators of hese Communities 
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Users that moderate one or more subreds willhave them listed on ther profi. These forums 
are likely thase which the user either created themselves or has invested alt of time and 
‘energy into inorder tobe appointed a moderator by someone else. This Ist is grea for geting a 
pattem of fe and determining some ofthe interests of your target asthe subredits they 
‘moderate are kaly tobe on subjects more personal ad close to thar. In the above example, 
‘we can quickly detormine our target's intrests and political leanings based on the communis 
he maderatas alone, 


Profile: Public Custom Feeds 
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Public Custom Feads are subreds that a Rack user chose to tack and receive updates on, 
‘You may see the name ofthe feed created by the user on their Rel Prof. licking on that 
‘name wll open the feed page whic wil display the Ist ofall subredlts within the feed onthe 
top right side of the new page. Inthe above example the user has 2 feed ited “ar, and upon 
‘opening the feed we can soe thal includes many subredds related to augmented realty 
Public custom feeds ofer the same typeof insight as the Moderators ofthese Communitios 
section ofa user's profile. These feeds may help you determine a users hobbies, cies, or ther 
pattern off information, 


Conclusion 


ape tat this guide shows you just hw resourceful Red canbe in an OSINT investigation 
Ifyou would tka to take this a slop further and star a Redli-based invastigation on your own 
have created a graphical guide and 3 took contaning the sama fools | use for my on 
RReuidi-hased investigations. You can dawnload both of hase frm my Github repository hers 
‘Should you have any questions or problems with he tools, or would ike some assistance on 
FRodalt or another particular platform, plase fel fre to reach out lo me on Twitter. 


